SCS-C02 Practice Test 28 — 15 Questions

Question 1

An organization is using IAM roles for EC2 instances. The security team needs to ensure that each EC2 instance can only assume a specific role based on tags. Which feature should be used?

Accepted Answer

Role trust policy with 'aws:ResourceTag' condition. The role trust policy can use the 'aws:ResourceTag' condition key to restrict which EC2 instances can assume the role based on the instance's tags. This ensures that only instances with specific tags (e.g., 'Environment=Production') are allowed to assume the IAM role, meeting the security team's requirement for tag-based role assumption.

Answer

Service Control Policy (SCP)

Answer

IAM policy with 'aws:SourceIp' condition

Answer

IAM permissions boundary

Question 2

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Accepted Answer

Add a bucket policy that denies requests without aws:SecureTransport. Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data. Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.

Answer

Enable S3 Access Logs and send them to a separate account

Answer

Enable MFA Delete on the S3 bucket

Answer

Use pre-signed URLs for all access

Question 3

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Accepted Answer

Add a route in the private subnet's route table pointing to the NAT gateway.. A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Answer

Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

Answer

Attach an internet gateway to the private subnet's route table.

Answer

Create a VPC gateway endpoint for Amazon S3.

Question 4

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail.. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.

Answer

Amazon CloudWatch Logs.

Answer

VPC Flow Logs.

Answer

AWS Config.

Question 5

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.. CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Answer

Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.

Answer

Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.

Answer

Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.

Question 6

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 7

A security engineer is reviewing the following IAM policy attached to an S3 bucket: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

Accepted Answer

The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.. The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Answer

The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

Answer

The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

Answer

The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

Question 8

Which THREE AWS services can be used to centrally manage security across multiple accounts? (Select THREE.)

Accepted Answer

AWS Config. AWS Config is correct because it provides a centralized view of resource configurations and compliance across multiple accounts when integrated with AWS Organizations. By enabling Config in the management account and using aggregation authorizations, you can aggregate configuration and compliance data from all member accounts into a single administrator account, enabling centralized security governance.

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 9

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

Accepted Answer

Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.. It uses a centralized S3 bucket in a dedicated logging account with a bucket policy that explicitly grants CloudTrail from source accounts the s3:PutObject permission. This ensures logs are written directly to a single location without intermediate replication or cross-account delivery that could introduce latency or complexity. The bucket policy can restrict access to only CloudTrail service principals and specific source account ARNs, maintaining a secure, auditable log trail.

Answer

Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.

Answer

Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.

Answer

Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.

Question 10

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

Accepted Answer

The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.. The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Answer

The condition key should be 'aws:sourceIp' (lowercase 's').

Answer

The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.

Answer

The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.

Question 11

Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)

Accepted Answer

Use a strong password and store it securely. The root user has unrestricted access to all AWS resources and services, so a strong, complex password (e.g., at least 14 characters with mixed case, numbers, and symbols) is essential to prevent brute-force or credential-stuffing attacks. Storing this password securely—such as in a password manager with restricted access or a physical safe—ensures it is available only to authorized personnel for emergency break-glass scenarios, aligning with the principle of least privilege and the AWS Well-Architected Framework's security pillar.

Answer

Share the root user password with the team for emergency access

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user for programmatic access

Question 12

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

Accepted Answer

Enable EBS encryption by default using the AWS managed key for Amazon EBS.. Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Answer

Use SSE-S3.

Answer

Use a customer-managed KMS key with automatic rotation enabled.

Answer

Use client-side encryption.

Question 13

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Accepted Answer

Amazon S3 server access logs. Amazon S3 server access logs capture detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, and action. This enables security analysis of API calls specifically targeting S3 resources. AWS CloudTrail records all API calls made to the AWS Management Console, SDKs, and CLI across the entire AWS account, providing a comprehensive audit trail for security analysis.

Answer

Amazon VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 14

A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.

Answer

AWS IAM Access Analyzer

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Accepted Answer

AWS Config. AWS Config is correct because it provides continuous monitoring and evaluation of your AWS resource configurations, including S3 bucket policies. You can create AWS Config rules (e.g., s3-bucket-policy-grantee-check) to detect changes to bucket policies and trigger compliance evaluations. When a policy change is detected, AWS Config can invoke an SNS topic to send notifications, enabling real-time alerting for unauthorized modifications.

Answer

Amazon Route 53

Answer

AWS CloudTrail

Answer

VPC Flow Logs